Passive reconnaissance

Nmap

Get the standard ports and run all the scripts and checks on them:

nmap -n -v -sT -sV -A <IP or FQDN> -oN nmap

Get a full TCP scan:

nmap -n -v -sT -sV -p- -Pn -A -T5 -sC <IP or FQDN> -oN nmap

Using a file with IP list:

nmap -n -v -sT -sV -p- -Pn -A -T4 -sC -iL <filename.txt> -oN nmap

Get a SYN scan:

<aside> ℹ️

The SYN scan sends a SYN packet (which is the first part of the TCP handshake sequence) to a port, and analyzes the response to determine whether the port is open, closed, or filtered.

</aside>

nmap -v -A -O -sV -p- -T4 -Pn -sS -sC <IP or FQDN> -oN nmap

Get Stealth Scan:

nmap -v -A -O -p- -T4 -Pn -sS -sC <IP or FQDN> -oN nmap --scan-delay 3s --max-parallelism 1 -Pn

AutoRecon - by Tib3rius